No, it could be much worse than that. Law enforcement didn't immediately shut Alphabay down---they let it run compromised for several weeks, gathering evidence. If Hutchins made transactions during that period, he was at signficant risk, especially if he was under surveilance at the time---simple traffic analysis would be enough to connect him to activity on the site. It's very hard to hide the content of a conversation from one of its participants.
I would think that when operating any type of illegal online enterprise, you should always operate under the assumption that everyone you're talking to is a government agent. So you should never reveal anything about yourself. The government is obviously making many undercover purchases.
Traffic analysis is a risk, but questionable. If it was used in this case, I want to follow this case closely to see more details. Because I haven't heard of a case of the government using traffic analysis to identify users except extremely basic stuff such as "we saw him walk into his house, then saw some Tor traffic, then saw a post appear on the forums".
